Cookie Policy and Consent in India: DPDP Compliance Basics

An Indian edtech website installs a cookie banner that says "By continuing to browse, you accept our use of cookies". There is no accept button, no reject option and no list of what the cookies do. The site runs a Meta pixel on every page, a session-recording tool that captures keystrokes in the application form, and an analytics script that sets identifiers lasting two years. A parent complains that her child's browsing behaviour was used to target ads. The company's defence is that the banner disclosed cookies.

It did not disclose anything useful, and under the Digital Personal Data Protection Act 2023 the banner's design is the legal problem. Cookies and similar technologies collect personal data — identifiers, IP addresses, device fingerprints, behavioural signals — and the Act requires consent before that processing begins. There is no separate Indian cookie statute, so the analysis runs through the general consent and notice rules. That makes the design of the banner, not just the text of the policy, the compliance question.

Are cookies personal data under Indian law?

Yes, in most cases. Section 2 of the DPDP Act defines personal data as data about an individual who is identifiable by or in relation to that data. A cookie identifier that is linked to a user account, an email address or a device that can be singled out is personal data. A random session cookie that expires when the browser closes and is not linked to anything else may fall outside the definition, which is why strictly necessary cookies are treated differently from analytics and advertising cookies.

The Information Technology Act 2000 and the SPDI Rules 2011 add a second layer for sensitive personal data such as passwords, financial information and health data. A cookie that stores a session token for a logged-in user is not itself sensitive, but the data it gives access to may be. Security obligations under Section 43A of the IT Act apply to the body corporate handling that data.

There is no Indian equivalent of the European ePrivacy Directive, so there is no standalone rule that says "cookies require prior consent". Instead, the DPDP Act's consent requirement does the work: if a cookie collects personal data, the fiduciary needs a lawful basis, and for advertising and analytics cookies that basis is normally consent.

Consent standards: why implied consent is a weak position

The Act requires consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Continued browsing is not a clear affirmative action. It is an inference drawn from inaction, and the Act does not recognise inaction as consent.

Three common banner designs fail this test.

• The notice-only banner. "By using this site you agree to our cookies." No action, no choice, no record.
• The pre-ticked banner. All categories switched on by default, with a single "Accept all" button. The affirmative action exists but the choice does not.
• The asymmetric banner. A bright "Accept" button and a grey, buried "Manage preferences" link that leads to a page with another accept button.

None of these produces valid consent for non-essential cookies. The design that does is unglamorous: a banner with equal-weight accept and reject buttons, a link to granular settings, no cookies set before a choice is made, and a record of the choice. The regulator's likely test is not whether the banner looked compliant but whether a reasonable user understood what they were agreeing to and could refuse without detriment.

Which cookies need consent, and which do not

The Act does not create cookie categories. The categories below are a drafting convenience that reflects the risk each type carries, and they are the ones Indian privacy practitioners use in practice.

Strictly necessary cookies are exempt in practice because they are required to deliver the service the user asked for, and the Act permits processing for the performance of a function the data principal requested. That exemption is narrow. A cookie that remembers a marketing campaign source is not strictly necessary, even if the marketing team treats it as essential.

What an Indian cookie policy should contain

A cookie policy is a disclosure document, and the Act's notice requirements apply to it as much as to the main privacy policy. It should contain the following.

Identity, contact and scope

The legal entity operating the website, the contact for cookie queries, and a statement of what the policy covers — the website, the app, and any subdomains or embedded tools. If the business operates multiple brands on separate domains, each policy should identify the relevant entity.

A cookie inventory

A table listing each cookie by name, provider, category, purpose, duration and whether it is first-party or third-party. This is the section that customers and regulators actually use. It should be generated from an automated scan of the live site rather than maintained by hand, because hand-maintained inventories drift within weeks of a marketing campaign launch.

Purposes and legal basis

For each category, state the purpose and the basis. For strictly necessary cookies, the basis is the performance of the requested service. For analytics and advertising, the basis is consent. Avoid claiming "legitimate interest" — that concept belongs to the GDPR and is not a ground under the DPDP Act, whose legitimate uses are a closed list.

Consent, refusal and withdrawal

Explain how the user can accept, refuse or customise cookies, how to change the choice later, and how to withdraw consent. State that refusing non-essential cookies does not prevent access to the core service. Provide a working link to the preference centre, not just instructions to clear browser cookies.

Third parties and cross-border transfer

Name the third-party providers — analytics, advertising, embedded video, chat widgets — and state that those providers may process data outside India. Under the DPDP Act, cross-border transfer is permitted subject to restrictions notified by the central government; the policy should be accurate about where data goes rather than silent.

Children and sensitive processing

If the website is likely to be accessed by children, say what cookies are set and confirm that behavioural tracking and targeted advertising are not directed at children. The Act requires verifiable parental consent before processing a child's data and prohibits tracking and targeted advertising directed at children, so a site that runs retargeting pixels on a children's section has a design problem, not just a disclosure problem.

Designing a consent banner that survives scrutiny

The banner is where the policy becomes real. Five design decisions determine whether the consent is valid.

• No non-essential cookies before choice. Load analytics and advertising scripts only after the user accepts. A banner that appears after the pixel has already fired is disclosure after the fact.
• Equal prominence. Accept and reject should be the same size and colour. A reject option hidden behind a settings link is not a real choice.
• Granular categories. Separate toggles for functional, analytics and advertising. Each toggle off by default except strictly necessary.
• Plain language. State what each category does in one sentence, without "personalised experience" and "trusted partners".
• Persistent access. A link in the footer to reopen the preference centre, and a record of the consent version, timestamp and choice.

The technical implementation matters as much as the wording. A consent management platform should block tags until consent is given, store the consent record with a version identifier, and pass the consent state to the tag manager. Many Indian implementations display a compliant banner while the Google Tag Manager container fires on page load regardless — the banner is decoration and the consent is fiction.

Consent records and the evidentiary burden

Under the Act, the data fiduciary bears the burden of proving that consent was given. That means keeping a record for each data principal showing what was consented to, when, under which version of the notice, and how. For cookie consent, the record should capture the banner version, the categories accepted, the timestamp and a user or device identifier.

Retention of consent records should be tied to the limitation period for complaints and to the retention of the underlying data. Keeping consent logs for three years after the relationship ends is a common practice; keeping them indefinitely creates its own data protection problem.

Cookies and the main privacy policy

The cookie policy should not duplicate the privacy policy. The privacy policy covers the overall processing, the rights and the grievance route; the cookie policy covers the technologies and the choices. Cross-refer between them so a user can move from one to the other without hunting.

Where the two documents conflict — for example, the privacy policy says data is not shared with advertisers and the cookie policy lists an advertising pixel — the conflict is evidence of inaccurate notice. Keep a single data inventory as the source of truth and generate both documents from it.

Other rules that touch cookies in India

Intermediary Guidelines 2021

If the website is an intermediary hosting user content, the Intermediary Guidelines require published terms, a grievance officer and response timelines. Cookies that enable user tracking should be described consistently with those terms.

Sectoral guidance

Regulated sectors add expectations. Banks and insurers are expected to disclose tracking practices and to obtain consent for marketing; healthcare providers handle health data that attracts higher security obligations; telecom providers operate under licensing conditions that restrict certain processing. A cookie policy drafted for a generic e-commerce site will not satisfy a bank's compliance team.

Advertising standards

Advertising code in India requires that advertisements be honest and not misleading, and that they not take advantage of consumers' inexperience. Retargeting a user who declined marketing consent is both a data protection problem and, potentially, a misleading practice if the user was told they would not be contacted.

Common mistakes in Indian cookie compliance

• Consent by continued browsing. Not consent under the Act.
• Pre-ticked categories. No affirmative action, no valid consent.
• Banner after the pixel fires. Disclosure after processing has begun.
• No reject button of equal prominence. Consent is not free if refusal is difficult.
• Hand-maintained cookie list. Out of date within weeks.
• No consent record. The fiduciary cannot discharge its evidentiary burden.
• Claiming legitimate interest. Not a ground under the Act.
• No withdrawal route. The Act requires withdrawal to be as easy as consent.
• Retargeting pixels on children's pages. Prohibited tracking of children.

Frequently asked questions

Do I need a cookie banner on an Indian website?

If the site sets cookies that collect personal data for analytics, advertising or social plugins, yes — the DPDP Act requires consent for that processing, and a banner is the practical way to collect it. Strictly necessary cookies do not need consent, but they should still be disclosed.

A site that sets no cookies other than a session cookie and collects no analytics may not need a banner, but it still needs a privacy notice if it collects personal data through forms.

Is implied consent from continued browsing valid under the DPDP Act?

No. The Act requires a clear affirmative action, and continued browsing is inaction. A banner that only informs the user and treats continued use as acceptance does not produce valid consent for non-essential cookies.

The practical consequence is that advertising and analytics cookies set before an affirmative choice are being processed without a lawful basis, which is the exposure the Act's penalties target.

Can we refuse access to users who decline cookies?

Not for the core service. Consent must be unconditional, meaning the service cannot be made conditional on consent to processing that is not necessary to provide it. A cookie wall that blocks access unless the user accepts advertising cookies is a weak position under the Act.

You can refuse access to a premium feature that genuinely depends on the non-essential processing, provided that is made clear and the core service remains available without it.

What should a cookie policy list for each cookie?

Name, provider, category, purpose, duration and whether it is first-party or third-party. Add a column for the legal basis and, for third-party cookies, a link to the provider's own policy. Keep the table generated from an automated scan rather than a manual list.

If a cookie's purpose cannot be explained in one sentence, the cookie probably should not be on the site.

How long can we keep consent records?

Long enough to defend a complaint and to match the retention of the underlying data. Three years after the end of the relationship is a reasonable default; longer may be justified where the data itself is retained for statutory periods. Keeping consent logs indefinitely, with no deletion policy, creates a separate retention problem.

Record the consent version, timestamp, categories chosen and identifier, and store the record in a system you can query when a complaint arrives.

Do third-party pixels make us a data fiduciary?

Yes, for the processing you determine. When you embed an advertising pixel on your site and decide which audiences to target, you are determining the purpose and means of processing and are a data fiduciary for that activity. The pixel provider may be a processor acting on your instructions, or an independent fiduciary for its own purposes — the contract and the provider's terms determine which.

Either way, you need a lawful basis for the collection and an accurate disclosure naming the provider.

Drafting Support

Our drafting team prepares cookie policies and consent notices for Indian websites and apps, including cookie inventories, preference-centre copy and consent records.